[SLING-9770] XSS API encodeForCSSString should sometimes leave the '>' character alone

• Type: Bug
• Status: Open
• Priority: Major
• Resolution: Unresolved
• Affects Version/s: XSS Protection API 2.2.6
• Component/s: XSS Protection API
• Assignee: Unassigned
• Reporter: Nicolas Peltier
• Created: 26/Sep/20 17:02
• Updated: 26/Sep/20 17:02

Description

while

xssApi.encodeForCSSString should righteously encode "JavaScrIpt some text>" into "JavaScrIpt some text
3e"it should leave ".foo > .bar { some rule }" alone as changing here the '>' character will break the CSS